CVE-2019-11396: 
Avira Software Updater vulnerability analysis and mitigation

A local privilege escalation vulnerability was discovered in Avira Free Security Suite 2019's Software Updater (version 2.0.6.13175 and earlier). The vulnerability (CVE-2019-11396) was disclosed on August 29, 2019, and stems from permissive access rights on the SoftwareUpdater folder that are incompatible with the privileged file manipulation performed by the product (Full Disclosure).

The vulnerability allows unprivileged users to exploit improper access control (CWE-284) through the SwuConfig.json file creation process. An unprivileged user can replace these files with symbolic links to arbitrary files. When an update occurs, a privileged service creates a file and sets its access rights, offering write access to the Everyone group in any directory, which can be leveraged for privilege escalation (Full Disclosure).

The vulnerability allows an unprivileged local user to obtain SYSTEM privileges on affected Windows systems, effectively providing complete control over the system (Full Disclosure).

The vulnerability requires local access to the system and can be exploited by an unprivileged user through manipulation of the SoftwareUpdater folder permissions and symbolic link creation. The attack requires user interaction to trigger the update process (Full Disclosure).

The vulnerability was reported to Avira on April 15, 2019, and after several attempts at fixes, was finally patched on July 8, 2019. Users should ensure they are running a version of Avira Free Security Suite newer than the affected version 2.0.6.13175 (Full Disclosure).